Stop Unexpected Safari Pop-ups Asking for Export Keys or System Access

Safari popping up requests for export keys or system access with no obvious trigger is almost always a sign of malware, a rogue extension, or a configuration profile.

Work through the fixes in order: block pop-ups, disable suspicious extensions, remove configuration profiles, clear out adware, and tighten Safari's safety settings so the prompts stop coming back.

In this guide, I have covered:

Why Safari Asks for Export Keys or System Access Out of Nowhere

Legitimate Safari pop-ups usually come from a site you visited or an extension you installed. When a dialog asks for an export key, Keychain access, or another privileged action while you are doing nothing of the sort, something else is driving it. On macOS, malware, browser hijackers, and configuration profiles can all inject prompts like that.

One known offender is a background process called SafariSearchUploadWorker, which has been reported pushing system access prompts with no clear user action behind them. Apple’s own guide to blocking pop-ups in Safari on Mac makes a related point: if you block pop-ups on a site and they keep coming anyway, you may have unwanted software on your Mac.

• Adware or “Potentially Unwanted Programs” (PUPs) installed through bundled software downloads.
• A Safari extension you did not knowingly install.
• A configuration profile pushed by remote management tools or by suspicious software.
• A website abusing JavaScript dialogs to ask for elevated permissions.

The fixes below run from the simplest (shut pop-ups off at the browser boundary) to the deepest (clear out adware and configuration profiles). Work through them in order and the prompts should stop. Seeing the same Safari export key pop-up on an iPhone or iPad? The steps to allow or block pop-ups in Safari on iPhone and iPad are different.

Block Pop-ups From Unwanted Sites in Safari Settings

Safari can block JavaScript pop-ups globally and per site. Tighten that boundary first: even if a malicious script fires a dialog, Safari swallows it before you see it.

1. Open Safari and choose Safari → Settings from the menu bar.
2. Click Websites in the settings toolbar.
3. Scroll down the left sidebar and click Pop-up Windows (Apple’s docs note: “If you don’t see Pop-up Windows, be sure to scroll to the bottom of the list”).
4. Set the pop-up menu labeled When visiting other websites to Block.
5. For any site already listed, click the site’s name and choose Block from the pop-up menu on the right.
6. Close the settings window. Safari saves the changes automatically.

If Safari blocks a pop-up you actually wanted on a specific page, click the Show button that appears in the Smart Search field. That lets the dialog through once, on that page only.

Disable or Remove Suspicious Safari Extensions

An extension you do not remember installing, or one that has gone bad, can trigger access prompts. Disable anything unfamiliar first, then remove it.

1. Launch the Apple Safari app on your Mac computer.
2. Click on the Safari menu from the menu bar at the top, and select Settings... sub-menu.
   It will open the Safari Settings window.
3. Switch to the Extensions tab in the Settings window.
   It will display the list of all the Safari extensions installed.
4. Uncheck the checkbox in the left side pane to Disable the extension.

Once Safari reopens, check the Extensions pane again. If a known extension still causes prompts, click it and choose Uninstall. Restart Safari when you are done.

You’ll know it worked when the Extensions list shows only names you recognize and no prompt appears after a restart.

Apple’s Mac App Store and Safari extensions are signed and sandboxed, but third-party extensions downloaded outside the App Store have wider system access. Anything not from a developer you recognize should be removed.

Review and Remove Configuration Profiles

Configuration profiles can change Safari behavior, install certificates, and grant elevated permissions without you noticing. Anything you did not install yourself, or anything pushed by an employer, school, or a piece of software, belongs on this list to review.

1. Quit Safari.
2. Click the Apple menu and choose System Settings.
3. Click General in the sidebar, then click Device Management. (On macOS 12 or earlier, choose Profiles inside System Preferences instead.)
4. Select any profile you do not recognize and click the Remove button (or the minus button below the list). Confirm with Remove.
5. Repeat for every unfamiliar profile, then close System Settings.

ALERT: If a profile is managed by your employer, school, or another administrator, removing it may lock you out of that organization’s resources or be detected. Confirm before removing profiles you are unsure about.

Look for and Remove Unwanted Software

Apple builds a malware tool into macOS that catches the most common adware. If the prompts survive the steps above, check your Applications folder and login items by hand.

1. Open System Settings → General → Login Items (or Users & Groups → Login Items on older macOS).
2. Select anything suspicious in the list and click the minus button below it.
3. Open Finder → Applications. Look for app icons you do not recognize, especially “cleanup,” “search,” or “media” tools.
4. Drag any unfamiliar app to the trash, then right-click the trash icon in the Dock and choose Empty Trash.
5. Open Finder → Go → Go to Folder (or press Shift+Cmd+G) and check ~/Library/LaunchAgents and /Library/LaunchAgents for suspicious .plist files. Delete anything tied to the apps you just removed.

TIP: Apple’s built-in XProtect and MRT (Malware Removal Tool) update silently in the background. Restart your Mac after removing suspicious software so they can run a clean scan.

Clear Safari Cache, Cookies, and Website Data

Cached files and stored website data can bring the same prompts back after you think you’ve dealt with them. Wipe Safari’s local state so the offending scripts have nothing to reload from.

Restart Safari once the clearing finishes. Reopen only sites you trust, and re-block the known offender under Settings → Websites → Pop-up Windows. If the same site nags you on iPhone or iPad too, block that website in Safari on iPhone and iPad as well.

Turn On Safari’s Fraudulent Website Warning

Safari’s safe-browsing check warns you before it loads a known phishing or malware page. Turn it on and Safari can stop the source page from loading at all, which kills the prompt before it fires.

1. In Safari, choose Safari → Settings from the menu bar.
2. Click Security in the toolbar.
3. Check the box next to Warn when visiting a fraudulent website.
4. Close the settings window.

Update Safari and macOS

Safari updates arrive through macOS updates, and so do Apple’s malware definitions. An out-of-date Mac is easier to hit with these prompts.

1. Click the Apple menu and choose System Settings (or System Preferences on macOS 12 and earlier).
2. Click General → Software Update.
3. Install any available updates, including Safari and security updates.
4. Restart the Mac when prompted.

RELATED: Stop Safari Settings from Resetting After a macOS Update